What’s Vulnerable › Vulnerabilities

CVE-2026-82282: Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-09-24
• Weakness: CWE-306

Description

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Affected products

• runatlantis atlantis: through 0.47.1

References

• https://github.com/runatlantis/atlantis
• https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go
• https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go
• https://github.com/runatlantis/atlantis/issues/6622
• https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers

Get alerted when CVE-2026-82282 or the next vulnerability affects your stack